Security RED FLAG For root .profile?

[joe_91]

Team:

The security software shows RED FLAG for root's .profile. The permission is 400 for .profile with owner as root:sys. here is the error after running the report
/.profile daemon: : GID is sys, expected daemon
/.profile hpdb:ALLBASE: GID is sys, expected other
/.profile www: : GID is sys, expected other

I am not sure how to correct it? Any ideas?

Thanks

Joe.

[Fred Ruffet]

I don't know why it is said to be related to .profile, but what is displayed is default groups for those users, and they seem not to be correct. You should correct this with this commands :
usermod -g daemon daemon
usermod -g other hpdb
usermod -g other www

This should correct the problem.

Regards,

Fred

[Cheryl Griffin]

I am not sure how to interpret your report, but you can report on the group id using the following:
# id daemon
# id hpdb
# id www

For example:
# id www
uid=30(www) gid=1(other)

The gid is stored in the /etc/passwd file.
www:*:30:1::/:

[Patrick Wallek]

I honestly wouldn't worry about it much.

It is flagging the /.profile because the home directory for each of those users is /, thus it will use the same .profile as the root user, whose home dir is also / by default. The default for root's .profile is owner=root and group=sys, thus you're getting the GID is sys for /.profile.

None of those users should be able to login and you normally don't even su to them, at least I never have, so the .profile should never even be used.

I guess you could try setting up a separate home directory for each of those users /hpdb, /daemon, /www and give them their own profile with the expected permissions. I don't think that would effect anything else. It'd just be non-standard.

[joe_91]

I am not able to usermod 'coz it says Cannot modify user 'hpdb': Home directory '/' is shared

Joe

[joe_91]

how to add the home direcory for these users?

joe

[joe_91]

ok super. i added /daemon as the home dir and same way for others and the red is gone. will this have any other impacts?

Joe

[Patrick Wallek · Accepted solution]

I don't think it will impact anything, but I'm not 100% sure. I've never tried it.

[Fred Ruffet]

On my ref system, those user are affected to / as home. It shouldn't be a problem as long as they never log in... But we never know.
Better replace everything as said. If you can't use usermod, use sam, or, at least vi (oh ! what a bad advice !). If using vi, make sure to copy file before.

Regards,

Fred